'\" te
.\" To view license terms, attribution, and copyright for IP Filter, the default path is /usr/lib/ipf/IPFILTER.LICENCE. If the Solaris operating environment has been installed anywhere other than the default, modify the given path to access the file at the installed
.\" location.
.\" Portions Copyright (c) 2009, Sun Microsystems Inc. All Rights Reserved.
.\" Portions Copyright (c) 2014, Joyent, Inc. All Rights Reserved.
.TH IPFILTER 7 "Oct 7, 2014"
.SH NAME
ipfilter \- IP packet filtering software
.SH DESCRIPTION
.LP
IP Filter is software that provides packet filtering capabilities on a Solaris
system. On a properly setup system, it can be used to build a firewall.
.sp
.LP
Solaris IP Filter is installed with the Solaris operating system. However,
packet filtering is not enabled by default. See \fBipf\fR(8) for a procedure
to enable and activate the IP Filter feature.
.SH HOST-BASED FIREWALL
.LP
To simplify IP Filter configuration management, a firewall framework is created
to allow users to configure IP Filter by expressing firewall policy at system
and service level. Given the user-defined firewall policy, the framework
generates a set of IP Filter rules to enforce the desired system behavior.
Users specify system and service firewall policies that allow or deny network
traffic from certain hosts, subnets, and interface(s). The policies are
translated into a set of active IPF rules to enforce the specified firewall
policies.
.LP
Note -
.sp
.RS 2
Users can still specify their own ipf rule file if they choose not to take
advantage of the framework. See \fBipf\fR(8) and \fBipf\fR(5).
.RE
.SS "Model"
.LP
This section describes the host-based firewall framework. See svc.ipfd(8) for
details on how to configure firewall policies.
.sp
.LP
In a given zone, a three-layer approach with different precedence levels helps
the user achieve the desired behaviors.
.sp
.ne 2
.na
\fBGlobal Default\fR
.ad
.sp .6
.RS 4n
Global Default - Default system-wide firewall policy. This policy is
automatically inherited by all services unless services modify their firewall
policy.
.RE

.sp
.ne 2
.na
\fBNetwork Services\fR
.ad
.sp .6
.RS 4n
Higher precedence than Global Default. A service's policy allows/disallows
traffic to its specific ports, regardless of Global Default policy.
.RE

.sp
.ne 2
.na
\fBGlobal Override\fR
.ad
.sp .6
.RS 4n
Another system-wide policy that takes precedence over the needs of specific
services in Network Services layer.
.RE

.sp
.in +2
.nf
Global Override
      |
      |
Network Services
      |
      |
Global Default
.fi
.in -2
.sp

.sp
.LP
A firewall policy includes a firewall mode and an optional set of network
sources. Network sources are IP addresses, subnets, and local network
interfaces, from all of which a system can receive incoming traffic. The basic
set of firewall modes are:
.sp
.ne 2
.na
\fBNone\fR
.ad
.sp .6
.RS 4n
No firewall, allow all incoming traffic.
.RE

.sp
.ne 2
.na
\fBDeny\fR
.ad
.sp .6
.RS 4n
Allow all incoming traffic but deny from specified source(s).
.RE

.sp
.ne 2
.na
\fBAllow\fR
.ad
.sp .6
.RS 4n
Deny all incoming traffic but allow from specified source(s).
.RE

.SS "Layers in Detail"
.LP
The first system-wide layer, Global Default, defines a firewall policy that
applies to \fBany\fR incoming traffic, for example, allowing or blocking all
traffic from an IP address. This makes it simple to have a policy that blocks
all incoming traffic or all incoming traffic from unwanted source(s).
.sp
.LP
The Network Services layer contains firewall policies for local programs that
provide service to remote clients, for example, \fBtelnetd\fR, \fBsshd\fR, and
\fBhttpd\fR. Each of these programs, a network service, has its own firewall
policy that controls access to its service. Initially, a service's policy is
set to inherit Global Default policy, a "Use Global Default" mode. This makes
it simple to set a single policy, at the Global Default layer, that can be
inherited by all services.
.sp
.LP
When a service's policy is different from Global Default policy, the service's
policy has higher precedence. If Global Default policy is set to block all
traffic from a subnet, the SSH service could be configured to allow access from
certain hosts in that subnet. The set of all policies for all network services
comprises the Network Service layer.
.sp
.LP
The second system-wide layer, Global Override, has a firewall policy that also
applies to any incoming network traffic. This policy has highest precedence and
overrides policies in the other layers, specifically overriding the needs of
network services. The example is when it is desirable to block known malicious
source(s) regardless of services' policies.
.SS "User Interaction"
.LP
This framework leverages IP Filter functionality and is active only when
\fBsvc:/network/ipfilter\fR is enabled and inactive when \fBnetwork/ipfilter\fR
is disabled. Similarly, a network service's firewall policy is only active when
that service is enabled and inactive when the service is disabled. A system
with an active firewall has IP Filter rules for each running/enabled network
service and system-wide policy(s) whose firewall mode is not \fBNone\fR.
.sp
.LP
A user configures a firewall by setting the system-wide policies and policy for
each network service. See svc.ipfd(8) on how to configure a firewall policy.
.sp
.LP
The firewall framework composes of policy configuration and a mechanism to
generate IP Filter rules from the policy and applying those rules to get the
desired IP Filter configuration. A quick summary of the design and user
interaction:
.RS +4
.TP
.ie t \(bu
.el o
system-wide policy(s) are stored in \fBnetwork/ipfilter\fR
.RE
.RS +4
.TP
.ie t \(bu
.el o
network services' policies are stored in each SMF service
.RE
.RS +4
.TP
.ie t \(bu
.el o
a user activates a firewall by enabling \fBnetwork/ipfilter\fR (see
\fBipf\fR(8))
.RE
.RS +4
.TP
.ie t \(bu
.el o
a user activates/deactivate a service's firewall by enabling/disabling that
network service
.RE
.RS +4
.TP
.ie t \(bu
.el o
changes to system-wide or per-service firewall policy results in an update to
the system's firewall rules

.SS "In-Zone and Global Zone Controlled firewalls"
.LP
Each non-global zone in the system can potentially have two firewalls
configured: the in-zone firewall and the Global Zone controlled (GZ-controlled)
firewall. The in-zone firewall can be controlled and observed inside the zone
using the framework detailed above, or from the Global Zone. The GZ-controlled
firewall can only be controlled and observed from the Global Zone. The
GZ-controlled firewall is always "outermost" with respect to the zone.
.sp
.LP
For inbound traffic (from an external source to the zone), the traffic flow looks
like the following diagram. Traffic blocked by the GZ-controlled firewall will
not be processed by the in-zone firewall.
.sp
.in +2
.nf
  External Source
        |
        |
GZ-controlled Firewall
        |
        |
  In-Zone Firewall
        |
        |
      Zone
.fi
.in -2
.sp
.LP
For outbound traffic (from the zone to an external destination), the traffic
flow looks like the following diagram. Traffic blocked by the in-zone firewall
will not be processed by the GZ-controlled firewall.
.sp
.in +2
.nf
      Zone
        |
        |
  In-Zone Firewall
        |
        |
GZ-controlled Firewall
        |
        |
 External Destination
.fi
.in -2
.sp
.LP
Either of the in-Zone or GZ-controlled firewalls can be enabled, or both at the
same time.
.sp
.LP
The Global Zone does not have a GZ-controlled firewall, only an
in-zone firewall.  For inbound traffic (from an external source to the global
zone), the traffic flow therefore looks like the following diagram.
.sp
.in +2
.nf
  External Source
        |
        |
  In-Zone Firewall
        |
        |
      Zone
.fi
.in -2
.sp
.LP
For outbound traffic (from the global zone to an external destination), the
traffic flow looks like the following diagram.
.sp
.in +2
.nf
      Zone
        |
        |
  In-Zone Firewall
        |
        |
 External Destination
.fi
.in -2

.SH ATTRIBUTES
.LP
See \fBattributes\fR(7) for a description of the following attributes:
.sp

.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE	ATTRIBUTE VALUE
_
Interface Stability	Committed
.TE

.SH SEE ALSO
.LP
.BR svcs (1),
.BR ipf (5),
.BR ipnat (5),
.BR attributes (7),
.BR smf (7),
.BR ipf (8),
.BR ipnat (8),
.BR svc.ipfd (8),
.BR svcadm (8)
.sp
.LP
\fISystem Administration Guide: IP Services\fR
.SH NOTES
.LP
The \fBipfilter\fR service is managed by the service management facility,
\fBsmf\fR(7), under the service identifier:
.sp
.in +2
.nf
svc:/network/ipfilter:default
.fi
.in -2
.sp

.sp
.LP
Administrative actions on this service, such as enabling, disabling, or
requesting restart, can be performed using \fBsvcadm\fR(8). The service's
status can be queried using the \fBsvcs\fR(1) command.
.sp
.LP
IP Filter startup configuration files are stored in \fB/etc/ipf\fR.
